Learning How to Thwart Security Attacks
October 28, 2024
Reference: 2024 Crowdstrike-related IT Outages
| Protocol | Port | Description |
|---|---|---|
| SSH | 22 | Secure Shell |
| HTTP | 80 | Hypertext Transfer Protocol |
| HTTPS | 443 | Hypertext Transfer Protocol Secure |
| FTP | 21 | File Transfer Protocol |
| SMTP | 25 | Simple Mail Transfer Protocol |
| DNS | 53 | Domain Name System |
| POP3 | 110 | Post Office Protocol 3 |
| IMAP | 143 | Internet Message Access Protocol |
| Telnet | 23 | Unencrypted text communications |
| NTP | 123 | Network Time Protocol |
iptables on a Linux serveriptables rules:
iptables on a Linux Server# Flush existing rules
sudo iptables -F
# Drop all incoming and forwarding traffic, allow outgoing
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT
# Allow incoming traffic on localhost
sudo iptables -A INPUT -i lo -j ACCEPT
# Allow incoming SSH connections
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Allow incoming HTTP and HTTPS traffic
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# Allow established and related incoming connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Save the rules
sudo iptables-save > /etc/iptables/rules.v4 5489 gkapfham 20 0 507568 207916 12836 R 6.0 0.3 83:03.61 nvim
4080 gkapfham 20 0 457480 157688 13480 S 1.7 0.2 30:49.27 nvim
34117 gkapfham 20 0 353912 54300 10160 S 1.0 0.1 21:09.79 nvim
5673 gkapfham 20 0 32.8g 600140 245208 S 0.7 0.9 15:48.35 brave
26197 gkapfham 20 0 372420 72632 12076 S 0.7 0.1 14:51.28 nvim
142753 gkapfham 20 0 377348 77484 11788 S 0.7 0.1 11:18.73 nvim
1422 root 20 0 1014944 124624 79648 S 0.3 0.2 5:40.33 X
1653 gkapfham 20 0 975088 109404 75032 S 0.3 0.2 2:31.56 picom
1687 gkapfham 20 0 154384 5984 5216 S 0.3 0.0 0:41.83 i3status
2447 gkapfham 20 0 17580 8416 3672 S 0.3 0.0 2:16.78 tmux: server
3023 gkapfham 20 0 2722832 36704 16348 S 0.3 0.1 2:05.64 lazygit
5229 gkapfham 20 0 21.1g 204076 55472 S 0.3 0.3 6:50.71 deno
142410 gkapfham 20 0 21.1g 177968 55900 S 0.3 0.3 5:48.26 deno
142514 gkapfham 20 0 2575176 31032 16032 S 0.3 0.0 0:47.63 lazygit
156934 gkapfham 20 0 385008 60516 17956 S 0.3 0.1 4:36.81 python3.12
176763 gkapfham 20 0 1156.1g 224924 128212 S 0.3 0.3 0:48.73 braveOperating system tracks each process, its owner, and its resources!
drwxr-xr-x - gkapfham users 31 Oct 07:27 .git
drwxr-xr-x - gkapfham users 2 Sep 18:16 .github
.rw-r--r-- 2.4k gkapfham users 2 Sep 18:23 .gitignore
drwxr-xr-x - gkapfham users 29 Oct 12:48 .quarto
drwxr-xr-x - gkapfham users 12 Sep 07:54 _extensions
drwxr-xr-x - gkapfham users 16 Sep 11:34 _freeze
drwxr-xr-x - gkapfham users 2 Sep 18:16 _include
.rw-r--r-- 125 gkapfham users 2 Sep 19:17 _publish.yml
.rw-r--r-- 1.8k gkapfham users 18 Sep 20:27 _quarto.yml
drwxr-xr-x - gkapfham users 31 Oct 07:30 _site
drwxr-xr-x - gkapfham users 18 Sep 21:35 css
drwxr-xr-x - gkapfham users 2 Sep 18:43 icons
drwxr-xr-x - gkapfham users 2 Sep 18:47 images
.rw-r--r-- 5.4k gkapfham users 28 Oct 21:21 index.qmd
drwxr-xr-x - gkapfham users 30 Oct 09:16 projects
.rw-r--r-- 247 gkapfham users 3 Sep 09:08 README.md
drwxr-xr-x - gkapfham users 29 Oct 07:27 schedule
drwxr-xr-x - gkapfham users 31 Oct 07:30 slides
drwxr-xr-x - gkapfham users 29 Oct 15:12 syllabusdrwxr-xr-x - gkapfham 31 Oct 07:38 .
drwxr-xr-x - gkapfham 12 Sep 07:54 ├── _extensions
drwxr-xr-x - gkapfham 2 Sep 18:16 │ ├── mcanouil
drwxr-xr-x - gkapfham 12 Sep 07:54 │ └── r-wasm
drwxr-xr-x - gkapfham 16 Sep 11:34 ├── _freeze
drwxr-xr-x - gkapfham 16 Sep 11:34 │ ├── index
drwxr-xr-x - gkapfham 31 Oct 07:38 │ ├── site_libs
drwxr-xr-x - gkapfham 29 Oct 07:50 │ └── slides
drwxr-xr-x - gkapfham 2 Sep 18:16 ├── _include
drwxr-xr-x - gkapfham 2 Sep 20:55 │ └── html
.rw-r--r-- 125 gkapfham 2 Sep 19:17 ├── _publish.yml
.rw-r--r-- 1.8k gkapfham 18 Sep 20:27 ├── _quarto.yml
drwxr-xr-x - gkapfham 31 Oct 07:38 ├── _site
drwxr-xr-x - gkapfham 2 Sep 18:16 │ ├── allhands
drwxr-xr-x - gkapfham 18 Sep 21:42 │ ├── css
drwxr-xr-x - gkapfham 2 Sep 18:32 │ ├── icons
drwxr-xr-x - gkapfham 2 Sep 18:32 │ ├── images
.rw-r--r-- 37k gkapfham 31 Oct 07:38 │ ├── index.html
.rw-r--r-- 911 gkapfham 31 Oct 07:38 │ ├── listings.json
drwxr-xr-x - gkapfham 30 Oct 09:16 │ ├── projects
.rw-r--r-- 53 gkapfham 4 Sep 15:52 │ ├── robots.txt
drwxr-xr-x - gkapfham 29 Oct 07:27 │ ├── schedule
.rw-r--r-- 316k gkapfham 31 Oct 07:38 │ ├── search.json
drwxr-xr-x - gkapfham 18 Sep 18:54 │ ├── site_libs
.rw-r--r-- 4.5k gkapfham 31 Oct 07:38 │ ├── sitemap.xml
drwxr-xr-x - gkapfham 31 Oct 07:38 │ ├── slides
drwxr-xr-x - gkapfham 29 Oct 15:12 │ └── syllabus
drwxr-xr-x - gkapfham 18 Sep 21:35 ├── css
.rw-r--r-- 4.8k gkapfham 18 Sep 21:35 │ └── styles.css
drwxr-xr-x - gkapfham 2 Sep 18:43 ├── icons
.rw-r--r-- 26k gkapfham 2 Sep 18:28 │ └── securitysynapse.png
drwxr-xr-x - gkapfham 2 Sep 18:47 ├── images
.rw-r--r-- 14k gkapfham 2 Sep 18:27 │ └── Security-Synapse-Logo.svg
.rw-r--r-- 5.4k gkapfham 28 Oct 21:21 ├── index.qmd
drwxr-xr-x - gkapfham 30 Oct 09:16 ├── projects
.rw-r--r-- 8.9k gkapfham 30 Oct 09:14 │ └── index.qmd
.rw-r--r-- 247 gkapfham 3 Sep 09:08 ├── README.md
drwxr-xr-x - gkapfham 29 Oct 07:27 ├── schedule
.rw-r--r-- 3.3k gkapfham 29 Sep 16:08 │ ├── index.qmd
drwxr-xr-x - gkapfham 25 Sep 09:21 │ ├── weekfive
drwxr-xr-x - gkapfham 18 Sep 08:09 │ ├── weekfour
drwxr-xr-x - gkapfham 16 Sep 11:25 │ ├── weekone
drwxr-xr-x - gkapfham 10 Sep 09:18 │ ├── weekthree
drwxr-xr-x - gkapfham 10 Sep 07:49 │ └── weektwo
drwxr-xr-x - gkapfham 31 Oct 07:38 ├── slides
drwxr-xr-x - gkapfham 2 Sep 19:01 │ ├── css
.rw-r--r-- 1.3k gkapfham 30 Oct 15:56 │ ├── index.qmd
drwxr-xr-x - gkapfham 31 Oct 07:24 │ ├── weekeight
drwxr-xr-x - gkapfham 29 Oct 12:48 │ ├── weekfive
drwxr-xr-x - gkapfham 29 Oct 12:48 │ ├── weekfour
drwxr-xr-x - gkapfham 31 Oct 07:38 │ ├── weeknine
drwxr-xr-x - gkapfham 30 Oct 16:00 │ ├── weekseven
drwxr-xr-x - gkapfham 29 Oct 12:48 │ ├── weekthree
drwxr-xr-x - gkapfham 29 Oct 12:48 │ └── weektwo
drwxr-xr-x - gkapfham 29 Oct 15:12 ├── syllabus
.rw-r--r-- 26k gkapfham 29 Oct 15:12 │ └── index.qmdOperating system defines default permissions for files and directories. Within certain constraints, users can modify them using commands like chmod!
chmod to Set Permissions# Example file: data.json
# Permissions goal: rwxr-xr--
# Breakdown:
# User (owner): rwx (read, write, execute)
# Group: r-x (read, execute)
# Others: r-- (read)
# command to set these permissions
chmod 754 data.json
# resulting permission string
-rwxr-xr-- 1 owner group 0 Oct 10 12:34 data.jsonrwxr-xr--?754 used with chmod?Security Synapse